> ## Documentation Index > Fetch the complete documentation index at: https://docs.squawkvoice.ai/llms.txt > Use this file to discover all available pages before exploring further. # Okta SSO > Let your team sign in to SquawkVoice with Okta, using the SquawkVoice app from the Okta Integration Network The SquawkVoice app in the Okta Integration Network (OIN) connects your Okta org to your SquawkVoice account. Once it is set up, your team signs in to SquawkVoice with their Okta credentials, and you decide in Okta who can get in. The app supports **OpenID Connect (OIDC)** and **SAML 2.0**. A SquawkVoice account connects one SSO provider at a time, so pick one protocol when you set it up. Both work the same way for sign-in from SquawkVoice. They differ in the Okta dashboard tile: with OIDC the app's own tile signs people in, and with SAML you add a Bookmark App for the tile instead. ## Supported Features * **SP-initiated SSO (OIDC and SAML):** people start on the SquawkVoice sign-in page, click **Sign in with SSO** and enter their work email. * **IdP-initiated SSO (OIDC):** people click the SquawkVoice tile on their Okta End-User Dashboard and land in SquawkVoice. * **Okta dashboard tile (SAML):** SquawkVoice doesn't accept a SAML sign-in that starts in Okta. The tile is a Bookmark App that opens SquawkVoice, which then signs the person in through Okta, with no extra prompt if they're already signed in to Okta. * **Just-in-time (JIT) provisioning (OIDC and SAML):** the first time someone you assigned in Okta signs in, SquawkVoice creates their user in your account, with their name from Okta. Not supported: SCIM provisioning (users aren't created, updated or deactivated from Okta ahead of sign-in) and Single Logout. ## Requirements * A SquawkVoice Enterprise plan. * Access to **Manage → Security & SSO** in SquawkVoice. * An Okta administrator who can add apps to your Okta org. * A company email domain your team signs in with, where you can add a DNS TXT record. Free email domains such as gmail.com can't be used. * Your SquawkVoice **Account ID**. To find it, open **Manage → Security & SSO** and, under **SSO provider**, choose **Okta** and **SAML**. The **SP Entity Id (Audience URI)** is `squawk-studio-acct-` followed by your Account ID. * Your region, in lower case: `us` if you sign in at `app.squawkvoice.ai`, `eu` if you sign in at `eu.app.squawkvoice.ai`. ## Configuration Steps **1. Verify your email domain in SquawkVoice** In SquawkVoice, open **Manage → Security & SSO**. Under **Verified domains**, enter your company's email domain and add it. SquawkVoice shows a **Host** and a **TXT value**. Add them as a TXT record in your domain's DNS, then click **Verify**. DNS changes can take a while to be visible; if the record isn't found yet, try again later. Only people whose email is at a verified domain can sign in with SSO, so create your Okta users with those email addresses. With SAML, the email SquawkVoice receives is the person's Okta **username**, so their username must be at a verified domain too. **2. Add the SquawkVoice app in Okta** In the Okta Admin Console, go to **Applications → Applications** and click **Browse App Catalog**. Search for **SquawkVoice**, open it and click **Add Integration**. Enter: * **SquawkVoice Account ID:** your Account ID (see [Requirements](#requirements)). * **Region:** `us` or `eu` in lower case, matching where you sign in to SquawkVoice. Click **Done**. > [!WARNING] > > Enter the region in lower case. Anything other than `us` or `eu`, such as `EU` in capitals, falls back to the US region, and EU sign-ins then fail. **3. Connect Okta to SquawkVoice** Follow the tab for the protocol you chose. > [tab] OIDC > > 1. In the app's **Sign On** tab, choose **OpenID Connect** as the sign-on method. > 2. Copy the **Client ID** and **Client secret**. You also need your Okta **Issuer URL**: your Okta org's address, such as `https://your-org.okta.com`. Use the org address itself, not an authorization server path such as `/oauth2/default`. > 3. Back on **Manage → Security & SSO**, under **SSO provider**, choose **Okta** as your identity provider and **OIDC** as the protocol. > 4. Paste the **Client Id**, **Issuer URL** and **Client secret** from Okta, and click **Save provider**. > [tab] SAML > > 1. In the app's **Sign On** tab, choose **SAML 2.0** as the sign-on method and click **Save**. > 2. Under **Metadata details**, copy the **Metadata URL**. > 3. Back on **Manage → Security & SSO**, under **SSO provider**, choose **Okta** as your identity provider and **SAML** as the protocol. > 4. Paste the **Metadata URL** and click **Connect**. SquawkVoice reads the rest from the metadata and saves the provider. > > With SAML, also do step 5 to give your team a dashboard tile. **4. Assign people** In the SquawkVoice app's **Assignments** tab, assign the people or groups who should be able to sign in to SquawkVoice. **5. Add a dashboard tile (SAML only)** Okta can't start a SAML sign-in into SquawkVoice from the app's own tile, because SquawkVoice accepts only SAML sign-ins that start from SquawkVoice. Hide that tile and add a Bookmark App in its place. With OIDC, skip this step: the app's own tile works. 1. In the SquawkVoice app's **General** tab, edit **App Settings**, tick **Do not display application icon to users**, and save. 2. On **Manage → Security & SSO**, under **Open Studio from your app portal**, copy the **Dashboard tile URL**. 3. In Okta, go to **Applications → Browse App Catalog**, open **Bookmark App** and click **Add Integration**. Name it `SquawkVoice`, paste the Dashboard tile URL as the **URL**, and click **Done**. 4. Assign the Bookmark App to the same people and groups as the SquawkVoice app. **6. Optionally, require SSO** Under **Sign-in rules**, turn on **Require SSO** to make SSO the only way your users at your verified domains can sign in. Password and Google sign-in stop working for them, and anyone signed in that way is signed out. Test an SSO sign-in before you turn this on. ## Signing In **From SquawkVoice (SP-initiated):** 1. Go to `app.squawkvoice.ai`, or `eu.app.squawkvoice.ai` in the EU. 2. Click **Sign in with SSO**. 3. Enter your work email and continue. You're sent to Okta to sign in, then back to SquawkVoice. **From Okta:** click the **SquawkVoice** tile on your Okta End-User Dashboard. With OIDC this is the app's own tile; with SAML it's the Bookmark App. ## How Users Work * **New users:** someone you've assigned in Okta who has no SquawkVoice user yet gets one in your account the first time they sign in, with standard account access. * **Email and name:** SquawkVoice takes the person's email from Okta, so it must be at a verified domain. With SAML, the email is the person's Okta username, sent as the NameID. Their name is filled in from Okta with either protocol. * **Existing users:** people who already have a SquawkVoice user in your account keep it and can now sign in with Okta. A user who belongs to a different SquawkVoice account can't sign in to yours with SSO. * **Removing access:** unassigning someone in Okta stops their next SSO sign-in, but doesn't delete their SquawkVoice user. An SSO session lasts at most 12 hours before SquawkVoice asks the person to sign in again. ## Troubleshooting | What you see | What to check | | - | - | | "Single sign-on is not set up for this email domain." | The email's domain is verified on **Security & SSO** and the provider is saved. | | "Your organization has not enabled sign-in with SSO for this account." after signing in to Okta | The email Okta sends is at a domain verified on **Security & SSO** of this account. With SAML this is the person's Okta username. | | Okta shows a `redirect_uri` error (OIDC) | The **Region** in the Okta app matches where you sign in to SquawkVoice. | | A SAML sign-in fails after Okta | The **Region** in the Okta app is `us` or `eu` in lower case, and the **SquawkVoice Account ID** matches yours. | | "Unable to process request due to missing initial state" | The SAML app's own tile was used. Use the Bookmark App tile (step 5), or sign in from SquawkVoice. | | The Okta tile opens SquawkVoice but doesn't sign you in | OIDC: the **SquawkVoice Account ID** in the Okta app matches yours. SAML: the Bookmark App's URL is the **Dashboard tile URL** from **Security & SSO**. | | "Your user belongs to a different account." | The person already has a SquawkVoice user in another account. Sign in the way you usually do, or contact support. | For help, contact [support@squawkvoice.ai](mailto:support@squawkvoice.ai). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.